1
- /* 4b74aa710b4ed5ce464b0ce544852cb47bf905c85a49c7bae2749f5885cb966d (2.2.5 +)
1
+ /* 19ac4776051591216f1874e34ee99b6a43a3784c8bd7d70efeb9258dd22b906a (2.2.6 +)
2
2
__ __ _
3
3
___\ \/ /_ __ __ _| |_
4
4
/ _ \\ /| '_ \ / _` | __|
@@ -161,6 +161,9 @@ typedef char ICHAR;
161
161
/* Round up n to be a multiple of sz, where sz is a power of 2. */
162
162
#define ROUND_UP (n , sz ) (((n) + ((sz) - 1)) & ~((sz) - 1))
163
163
164
+ /* Do safe (NULL-aware) pointer arithmetic */
165
+ #define EXPAT_SAFE_PTR_DIFF (p , q ) (((p) && (q)) ? ((p) - (q)) : 0)
166
+
164
167
/* Handle the case where memmove() doesn't exist. */
165
168
#ifndef HAVE_MEMMOVE
166
169
#ifdef HAVE_BCOPY
@@ -1820,6 +1823,7 @@ XML_Parse(XML_Parser parser, const char *s, int len, int isFinal)
1820
1823
parser -> m_errorCode = XML_ERROR_NO_MEMORY ;
1821
1824
return XML_STATUS_ERROR ;
1822
1825
}
1826
+ /* fall through */
1823
1827
default :
1824
1828
parser -> m_parsingStatus .parsing = XML_PARSING ;
1825
1829
}
@@ -1969,6 +1973,7 @@ XML_ParseBuffer(XML_Parser parser, int len, int isFinal)
1969
1973
parser -> m_errorCode = XML_ERROR_NO_MEMORY ;
1970
1974
return XML_STATUS_ERROR ;
1971
1975
}
1976
+ /* fall through */
1972
1977
default :
1973
1978
parser -> m_parsingStatus .parsing = XML_PARSING ;
1974
1979
}
@@ -2026,39 +2031,46 @@ XML_GetBuffer(XML_Parser parser, int len)
2026
2031
default : ;
2027
2032
}
2028
2033
2029
- if (len > parser -> m_bufferLim - parser -> m_bufferEnd ) {
2034
+ if (len > EXPAT_SAFE_PTR_DIFF ( parser -> m_bufferLim , parser -> m_bufferEnd ) ) {
2030
2035
#ifdef XML_CONTEXT_BYTES
2031
2036
int keep ;
2032
2037
#endif /* defined XML_CONTEXT_BYTES */
2033
2038
/* Do not invoke signed arithmetic overflow: */
2034
- int neededSize = (int ) ((unsigned )len + (unsigned )(parser -> m_bufferEnd - parser -> m_bufferPtr ));
2039
+ int neededSize = (int ) ((unsigned )len +
2040
+ (unsigned )EXPAT_SAFE_PTR_DIFF (parser -> m_bufferEnd ,
2041
+ parser -> m_bufferPtr ));
2035
2042
if (neededSize < 0 ) {
2036
2043
parser -> m_errorCode = XML_ERROR_NO_MEMORY ;
2037
2044
return NULL ;
2038
2045
}
2039
2046
#ifdef XML_CONTEXT_BYTES
2040
- keep = (int )(parser -> m_bufferPtr - parser -> m_buffer );
2047
+ keep = (int )EXPAT_SAFE_PTR_DIFF (parser -> m_bufferPtr , parser -> m_buffer );
2041
2048
if (keep > XML_CONTEXT_BYTES )
2042
2049
keep = XML_CONTEXT_BYTES ;
2043
2050
neededSize += keep ;
2044
2051
#endif /* defined XML_CONTEXT_BYTES */
2045
- if (neededSize <= parser -> m_bufferLim - parser -> m_buffer ) {
2052
+ if (neededSize <= EXPAT_SAFE_PTR_DIFF ( parser -> m_bufferLim , parser -> m_buffer ) ) {
2046
2053
#ifdef XML_CONTEXT_BYTES
2047
- if (keep < parser -> m_bufferPtr - parser -> m_buffer ) {
2048
- int offset = (int )(parser -> m_bufferPtr - parser -> m_buffer ) - keep ;
2054
+ if (keep < EXPAT_SAFE_PTR_DIFF (parser -> m_bufferPtr , parser -> m_buffer )) {
2055
+ int offset = (int )EXPAT_SAFE_PTR_DIFF (parser -> m_bufferPtr , parser -> m_buffer ) - keep ;
2056
+ /* The buffer pointers cannot be NULL here; we have at least some bytes in the buffer */
2049
2057
memmove (parser -> m_buffer , & parser -> m_buffer [offset ], parser -> m_bufferEnd - parser -> m_bufferPtr + keep );
2050
2058
parser -> m_bufferEnd -= offset ;
2051
2059
parser -> m_bufferPtr -= offset ;
2052
2060
}
2053
2061
#else
2054
- memmove (parser -> m_buffer , parser -> m_bufferPtr , parser -> m_bufferEnd - parser -> m_bufferPtr );
2055
- parser -> m_bufferEnd = parser -> m_buffer + (parser -> m_bufferEnd - parser -> m_bufferPtr );
2056
- parser -> m_bufferPtr = parser -> m_buffer ;
2062
+ if (parser -> m_buffer && parser -> m_bufferPtr ) {
2063
+ memmove (parser -> m_buffer , parser -> m_bufferPtr ,
2064
+ EXPAT_SAFE_PTR_DIFF (parser -> m_bufferEnd , parser -> m_bufferPtr ));
2065
+ parser -> m_bufferEnd = parser -> m_buffer +
2066
+ EXPAT_SAFE_PTR_DIFF (parser -> m_bufferEnd , parser -> m_bufferPtr );
2067
+ parser -> m_bufferPtr = parser -> m_buffer ;
2068
+ }
2057
2069
#endif /* not defined XML_CONTEXT_BYTES */
2058
2070
}
2059
2071
else {
2060
2072
char * newBuf ;
2061
- int bufferSize = (int )(parser -> m_bufferLim - parser -> m_bufferPtr );
2073
+ int bufferSize = (int )EXPAT_SAFE_PTR_DIFF (parser -> m_bufferLim , parser -> m_bufferPtr );
2062
2074
if (bufferSize == 0 )
2063
2075
bufferSize = INIT_BUFFER_SIZE ;
2064
2076
do {
@@ -2077,25 +2089,34 @@ XML_GetBuffer(XML_Parser parser, int len)
2077
2089
parser -> m_bufferLim = newBuf + bufferSize ;
2078
2090
#ifdef XML_CONTEXT_BYTES
2079
2091
if (parser -> m_bufferPtr ) {
2080
- int keep = (int )(parser -> m_bufferPtr - parser -> m_buffer );
2092
+ int keep = (int )EXPAT_SAFE_PTR_DIFF (parser -> m_bufferPtr , parser -> m_buffer );
2081
2093
if (keep > XML_CONTEXT_BYTES )
2082
2094
keep = XML_CONTEXT_BYTES ;
2083
- memcpy (newBuf , & parser -> m_bufferPtr [- keep ], parser -> m_bufferEnd - parser -> m_bufferPtr + keep );
2095
+ memcpy (newBuf , & parser -> m_bufferPtr [- keep ],
2096
+ EXPAT_SAFE_PTR_DIFF (parser -> m_bufferEnd , parser -> m_bufferPtr ) + keep );
2084
2097
FREE (parser , parser -> m_buffer );
2085
2098
parser -> m_buffer = newBuf ;
2086
- parser -> m_bufferEnd = parser -> m_buffer + (parser -> m_bufferEnd - parser -> m_bufferPtr ) + keep ;
2099
+ parser -> m_bufferEnd = parser -> m_buffer +
2100
+ EXPAT_SAFE_PTR_DIFF (parser -> m_bufferEnd , parser -> m_bufferPtr ) + keep ;
2087
2101
parser -> m_bufferPtr = parser -> m_buffer + keep ;
2088
2102
}
2089
2103
else {
2090
- parser -> m_bufferEnd = newBuf + (parser -> m_bufferEnd - parser -> m_bufferPtr );
2104
+ /* This must be a brand new buffer with no data in it yet */
2105
+ parser -> m_bufferEnd = newBuf ;
2091
2106
parser -> m_bufferPtr = parser -> m_buffer = newBuf ;
2092
2107
}
2093
2108
#else
2094
2109
if (parser -> m_bufferPtr ) {
2095
- memcpy (newBuf , parser -> m_bufferPtr , parser -> m_bufferEnd - parser -> m_bufferPtr );
2110
+ memcpy (newBuf , parser -> m_bufferPtr ,
2111
+ EXPAT_SAFE_PTR_DIFF (parser -> m_bufferEnd , parser -> m_bufferPtr ));
2096
2112
FREE (parser , parser -> m_buffer );
2113
+ parser -> m_bufferEnd = newBuf +
2114
+ EXPAT_SAFE_PTR_DIFF (parser -> m_bufferEnd , parser -> m_bufferPtr );
2115
+ }
2116
+ else {
2117
+ /* This must be a brand new buffer with no data in it yet */
2118
+ parser -> m_bufferEnd = newBuf ;
2097
2119
}
2098
- parser -> m_bufferEnd = newBuf + (parser -> m_bufferEnd - parser -> m_bufferPtr );
2099
2120
parser -> m_bufferPtr = parser -> m_buffer = newBuf ;
2100
2121
#endif /* not defined XML_CONTEXT_BYTES */
2101
2122
}
@@ -2908,9 +2929,11 @@ doContent(XML_Parser parser,
2908
2929
poolClear (& parser -> m_tempPool );
2909
2930
freeBindings (parser , bindings );
2910
2931
}
2911
- if ((parser -> m_tagLevel == 0 ) &&
2912
- !((parser -> m_parsingStatus .parsing == XML_FINISHED ) || (parser -> m_parsingStatus .parsing == XML_SUSPENDED ))) {
2913
- return epilogProcessor (parser , next , end , nextPtr );
2932
+ if ((parser -> m_tagLevel == 0 ) && (parser -> m_parsingStatus .parsing != XML_FINISHED )) {
2933
+ if (parser -> m_parsingStatus .parsing == XML_SUSPENDED )
2934
+ parser -> m_processor = epilogProcessor ;
2935
+ else
2936
+ return epilogProcessor (parser , next , end , nextPtr );
2914
2937
}
2915
2938
break ;
2916
2939
case XML_TOK_END_TAG :
@@ -4746,8 +4769,8 @@ doProlog(XML_Parser parser,
4746
4769
return XML_ERROR_NO_MEMORY ;
4747
4770
parser -> m_declEntity -> publicId = NULL ;
4748
4771
}
4749
- /* fall through */
4750
4772
#endif /* XML_DTD */
4773
+ /* fall through */
4751
4774
case XML_ROLE_ENTITY_SYSTEM_ID :
4752
4775
if (dtd -> keepProcessing && parser -> m_declEntity ) {
4753
4776
parser -> m_declEntity -> systemId = poolStoreString (& dtd -> pool , enc ,
@@ -6643,7 +6666,6 @@ hash(XML_Parser parser, KEY s)
6643
6666
{
6644
6667
struct siphash state ;
6645
6668
struct sipkey key ;
6646
- (void )sip_tobin ;
6647
6669
(void )sip24_valid ;
6648
6670
copy_salt_to_sipkey (parser , & key );
6649
6671
sip24_init (& state , & key );
0 commit comments